0

I would like to send logs of each application to a remote collector with syslog-ng.

If I have Apache, I'd like my Apache logs to be sent to my remote collector in the file /var/log/apache.log.

I couldn't find anything about this. I know it's possible with rsyslog but the only thing I'm able to do here is to send all the logs together with:

destination remote { network("<collector_adress>" transport("udp") port(514)); };

2 Answers 2

0

To collect logs from files with syslog-ng, you have to create file sources, and add them to a log statement. Something like this:

source s_apache {
    file("/var/log/apache.log");
};
log {
    source(s_apache); destination(remote);
};

To collect logs from other files as well, define additional sources and add them to the log statement. If you have an application that logs into several different log file (for example, into timestamped log files), you can use the wildcard-file source. Check the docs for details: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.21/administration-guide/16#TOPIC-1180423

0

I think you can use the same approach as in Syslog-ng - Send filename from client to server.

Client side configuration in syslog-ng -

file("/var/log/shell.log" log_prefix("shell: "));

Server side configuration in syslog-ng -

filter f_shell { match("shell" value("MSGHDR")); };

destination d_shell { file("/var/log/syslog-ng/shell.log"); };

log { source(demo_tls_src); filter(f_shell); destination(d_shell); flags(final); };

You must log in to answer this question.